hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: FastAPI: Model WebSocket usage

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-10-25 15:22:24 +02:00
parent b69977b37a
commit 7619d0fc33
6 changed files with 303 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
python/ql/test/library-tests/frameworks/fastapi/taint_test.py
View File

@@ -104,47 +104,47 @@ from fastapi import WebSocket
assert WebSocket == starlette.websockets.WebSocket
@app.websocket("/ws")
async def websocket_test(websocket: WebSocket):
@app.websocket("/ws") # $ routeSetup="/ws"
async def websocket_test(websocket: WebSocket): # $ requestHandler routedParameter=websocket
await websocket.accept()
ensure_tainted(
websocket, # $ MISSING: tainted
websocket, # $ tainted
websocket.url, # $ MISSING: tainted
websocket.url, # $ tainted
websocket.url.netloc, # $ MISSING: tainted
websocket.url.path, # $ MISSING: tainted
websocket.url.query, # $ MISSING: tainted
websocket.url.fragment, # $ MISSING: tainted
websocket.url.username, # $ MISSING: tainted
websocket.url.password, # $ MISSING: tainted
websocket.url.hostname, # $ MISSING: tainted
websocket.url.port, # $ MISSING: tainted
websocket.url.netloc, # $ tainted
websocket.url.path, # $ tainted
websocket.url.query, # $ tainted
websocket.url.fragment, # $ tainted
websocket.url.username, # $ tainted
websocket.url.password, # $ tainted
websocket.url.hostname, # $ tainted
websocket.url.port, # $ tainted
websocket.url.components, # $ MISSING: tainted
websocket.url.components.netloc, # $ MISSING: tainted
websocket.url.components.path, # $ MISSING: tainted
websocket.url.components.query, # $ MISSING: tainted
websocket.url.components.fragment, # $ MISSING: tainted
websocket.url.components.username, # $ MISSING: tainted
websocket.url.components.password, # $ MISSING: tainted
websocket.url.components.hostname, # $ MISSING: tainted
websocket.url.components.port, # $ MISSING: tainted
websocket.url.components, # $ tainted
websocket.url.components.netloc, # $ tainted
websocket.url.components.path, # $ tainted
websocket.url.components.query, # $ tainted
websocket.url.components.fragment, # $ tainted
websocket.url.components.username, # $ tainted
websocket.url.components.password, # $ tainted
websocket.url.components.hostname, # $ tainted
websocket.url.components.port, # $ tainted
websocket.headers, # $ MISSING: tainted
websocket.headers["key"], # $ MISSING: tainted
websocket.headers, # $ tainted
websocket.headers["key"], # $ tainted
websocket.query_params, # $ MISSING: tainted
websocket.query_params["key"], # $ MISSING: tainted
websocket.query_params, # $ tainted
websocket.query_params["key"], # $ tainted
websocket.cookies, # $ MISSING: tainted
websocket.cookies["key"], # $ MISSING: tainted
websocket.cookies, # $ tainted
websocket.cookies["key"], # $ tainted
await websocket.receive(), # $ MISSING: tainted
await websocket.receive_bytes(), # $ MISSING: tainted
await websocket.receive_text(), # $ MISSING: tainted
await websocket.receive_json(), # $ MISSING: tainted
await websocket.receive(), # $ tainted
await websocket.receive_bytes(), # $ tainted
await websocket.receive_text(), # $ tainted
await websocket.receive_json(), # $ tainted
)
# scheme seems very unlikely to give interesting results, but very likely to give FPs.
@@ -154,10 +154,10 @@ async def websocket_test(websocket: WebSocket):
)
async for data in websocket.iter_bytes():
ensure_tainted(data) # $ MISSING: tainted
ensure_tainted(data) # $ tainted
async for data in websocket.iter_text():
ensure_tainted(data) # $ MISSING: tainted
ensure_tainted(data) # $ tainted
async for data in websocket.iter_json():
ensure_tainted(data) # $ MISSING: tainted
ensure_tainted(data) # $ tainted